Scored across 6 tools
The six tools are largely distinct along clear axes: black-box URL scanning (scan_url), white-box repo scanning (scan_repo), dependency capability analysis (check_dependencies), AI agent config auditing (audit_ai_tooling), and rule explanation (explain_finding). The main fuzziness is between scan_repo, scan_url, and runtime_advisories, which all touch security headers, cookies, CORS, and runtime versions — the descriptions acknowledge this but an agent may still hesitate over which one to call for a header or version question.
Five of six tools follow a consistent snake_case verb_noun pattern (scan_url, scan_repo, check_dependencies, audit_ai_tooling, explain_finding). runtime_advisories breaks the pattern by being a bare noun phrase with no verb, a minor but noticeable deviation in an otherwise predictable set.
Six tools is well within the ideal 3-15 range for a focused security-assessment server. Each tool maps to a distinct surface (runtime target, source code, dependencies, AI config, explanation, runtime advisories) with no obvious filler.
The surface covers the full scan lifecycle reasonably: black-box, white-box, dependencies, AI tooling, plus explanation and version advisory lookup. Gaps are minor — there is no tool to list, aggregate, or export findings across scans, and no remediation/verification step after fixing, but agents can work around these by re-running scans.
